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WHAT IS CLAIMED IS: 

1 . A method for providing an improved network monitoring system, the network 
monitoring system comprising an event database for storing event data representing events 
occurring on the network, the event data being gathered by a plurality of monitoring devices 
located at a plurality of different, remote locations on the network, the method comprising: 

allowing users to insert one or more triggers into the event database, the triggers 
automatically initiating a programmed response at the detection of a condition including on 
gathered event data prior to insertion of the gathered event data into the event database; 

distributing the event database to a plurality of remote network locations, wherein 
each remote network location stores a local table containing event data generated at the remote 
location and one or more replica tables containing event data generated at other remote locations, 
and wherein a union of the local and replica tables is generated to form a combined event 
database at the remote location; and 

using triggers and local and replica table unions during delivery of event data to 
users of the network monitoring system. 

2. The method of claim 1, comprising providing a notification component for 
registering similar client requests for event data and substantially contemporaneously delivering 
requested event data to all clients having similar registered requests. 

3. An event database for use in a network monitoring system, the event database 
storing event data representing events occurring on the network, the event data being gathered by 
a plurality of monitor devices located at a plurality of different, remote locations on the network, 
the event database comprising: 

an automation engine for processing one or more triggers contained in the event 
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database, the triggers automatically initiating a programmed response at the detection of a 
condition including on gathered event data prior to insertion of the gathered event data into the 
event database; 

a local table stored at each remote network location containing event data 
5 generated at the remote location; and 

one or more replica tables stored at each remote network location containing 
event data generated at other remote locations, wherein a union of the local and replica tables is 
generated to form a combined event database at the remote location. 

4. A method for handling event data from monitored sites in a computer network, 

10 comprising: 

receiving event data from the sites at a monitoring location; 

when received at the monitoring location, pre-processing the event data before the 
event data is inserted into an event database to determine if a condition is met as set forth in a 
trigger; and 

1 5 if the trigger condition is met, initiating an action relating to the event data, the 

action being defined in the trigger. 

5. The method of claim 4, wherein pre-processing the event data comprises 
determining whether the event data comprises a duplication of other event data in the event 
database or received at the monitoring location. 

20 6. The method of claim 5, wherein initiating the action comprises denying 

storage of the event data in the event database if it comprises a duplication of other event data. 

7. The method of claim 4, wherein if the event data does not meet the condition, 
it is temporarily stored outside the data store. 

22 

BRMFSl 260847v2 



Atty Docket No. 3882/7 

8. The method of claim 4, wherein for event data received at the monitoring 
location, a query is executed, and a condition is evaluated, which, if true, causes the execution of 
the action. 

9. The method of claim 8, wherein the action comprises at least one of a sequence 
of Structured Query Language (SQL) statements and an external script. 

10. The method of claim 4, wherein the trigger has a coupling mode that 
indicates when the action should be executed. 

1 1 . The method of claim 4, wherein the trigger allows an administrator of the 
network to connect events, conditions and actions. 

12. The method of claim 4, wherein the event data comprises a primitive event. 

13. The method of claim 4, wherein the event data comprises a database event. 

14. The method of claim 4, wherein the event data comprises a temporal event. 

15. The method of claim 4, wherein the trigger comprises a database trigger. 

1 6. The method of claim 4, wherein the trigger comprises a temporal trigger. 

17. The method of claim 16, wherein the temporal trigger signals an event at a 
determined frequency from a specified start time until a specified end time. 

18. The method of claim 4, wherein initiating an action comprises 
communicating a message in accordance with the event data to at least one customer location 
that has subscribed to receive the event data, and storing the event data in a data store at the 
monitoring location. 

19. The method of claim 1 8, wherein the pre-processing occurs, at least in part, 
during a period when the data store is inaccessible. 

20. The method of claim 18, wherein the message communicated in accordance 
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with the event data comprises a union of at least event data of a local network and event data of a 
remote network. 

2 1 . The method of claim 20, wherein the union comprises a union of event data 

tables. 

5 22. The method of claim 4, wherein a plurality of monitoring locations are 

provided in the network, each having locally-generated event data, and a replica of remotely- 
generated event data. 

23. The method of claim 22, wherein the monitoring locations update one another 
with their event data. 

10 24. The method of claim 22, wherein at least one monitoring location is enabled 

to take ownership of a replica of remotely-generated event data to make modifications thereto 
without instructions from the remote monitoring location associated therewith. 

25. A system for handling event data from monitored sites in a computer 
network, comprising: 

1 5 means for receiving event data from the sites at a monitoring location; 

means for pre-processing the event data, when received at the monitoring 
location, to determine if a condition is met for setting a trigger; and 

means for communicating a message, if the trigger is set, in accordance with the 
event data to at least one customer location that has subscribed to receive the event data, and 
20 storing the event data in a data store at the monitoring location. 

26. An event database for use in a network monitoring system, the event database 
storing event data representing events occurring on the network, the event data being gathered by 
a plurality of monitor devices located at a plurality of different, remote locations on the network, 
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the event database comprising: 

a local table stored at each remote network location containing event data 
generated at the remote location; 

one or more replica tables stored at each remote network location containing 
event data generated at other remote locations; and 

means for generating a union of the local and replica tables to form a combined 
event database at the remote location. 
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